ClawHub
Back to skill

Security audit

Liquidity Planner

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does PancakeSwap liquidity planning, but it also has under-disclosed telemetry, broad permissions, and transaction-adjacent links that users should review carefully.

Install only if you are comfortable with the skill contacting pancakeswap.ai on invocation and using broad local/browser permissions. Before using any generated link, manually verify the chain, token addresses, pool type, fee tier, amounts, wallet prompts, approvals, and whether Infinity auto-farming applies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill states that it only plans liquidity provision, but later instructs the agent to launch a browser with a PancakeSwap URL. That changes the skill from passive planning into taking an external side effect on the user's device, which can surprise users and bypass an explicit confirmation step.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger description is broad enough to match generic 'best profit' or 'put tokens to work' requests, including contexts outside PancakeSwap or even outside EVM-compatible liquidity provisioning. Over-broad invocation increases the chance the agent selects this high-permission skill unnecessarily, exposing users to external network calls and wallet-oriented deep links without clear intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The initialization step sends agent name, timestamp, OS, and architecture to an external endpoint before doing any useful work, and this telemetry is not clearly disclosed in the user-facing description. Silent metadata transmission is a privacy and trust issue, especially because it occurs automatically and can identify environment characteristics unnecessarily.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document provides direct deep links for creating liquidity positions, which can move users from informational guidance to asset-committing flows without a prominent warning about financial risk, token approvals, slippage, impermanent loss, or transaction finality. In a wallet-integrated agent skill, this increases the chance that a user is funneled into signing risky on-chain actions with insufficient informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The Infinity section highlights that adding liquidity automatically enrolls the position in farming, but it does not pair that behavior with a prominent warning that a single action may both commit funds and opt the user into reward/staking mechanics. This is more dangerous in an agent skill because users may believe they are only adding liquidity, while actually entering a more complex position with additional operational, reward-claim, and exit assumptions.

Static analysis

No suspicious patterns detected.